Is our SaaS data backed up by the provider?
Usually not in the way you need. SaaS providers protect their service against their own failures, with redundant storage and disaster recovery, but they generally do not promise to restore your data after something you or an attacker did inside your account. Deleted items sit in recycle bins and version histories for a limited period and then go; a ransomware attack that encrypts synced files, a malicious admin who deletes mailboxes, or a sync error that overwrites a folder can outlast those periods; and when a subscription or user licence ends, the data may be removed. Read your provider's terms: most describe this split as part of shared responsibility. If the data matters, keep your own copy: a backup service or export that copies mail, files and key application data to storage the SaaS admins cannot delete, kept for as long as your business and legal needs require. Test a restore of a mailbox and a folder at least once, because that is when gaps appear. A network sensor does not help here; this is backup and retention planning.